{
  "@id": "urn:uuid:be4c097e-9d92-45da-9dcc-6e2468e80004",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2020-5413 does not affect version 5.5.12-tuxcare.3 of org.springframework.integration:spring-integration-core. CVE-2020-5413 is NOT present in spring-integration 5.5.12-tuxcare.4. The vulnerability concerns Kryo deserialization without registration requirements, allowing arbitrary class deserialization gadgets. The upstream fix (kryo.setRegistrationRequired(true)) was already present in the Spring Integration 5.5.12 release before TuxCare onboarded it. The fix is located in AbstractKryoCodec.java line 47, and all Kryo codec implementations (PojoCodec, MessageCodec) inherit this protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.23; >= 5.3.0, < 5.3.2; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8), NVD (>= 4.3.0, <= 4.3.22; >= 5.1.0, <= 5.1.11; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.1), cve.org (>= 4.3, < 4.3.23.RELEASE; >= 5.1, < 5.1.12.RELEASE; >= 5.2, < 5.2.8.RELEASE; >= 5.3, < 5.3.2.RELEASE), Snyk (>= 4.3.0, < 4.3.23; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5413"
      },
      "impact_statement": "CVE-2020-5413 is NOT present in spring-integration 5.5.12-tuxcare.4. The vulnerability concerns Kryo deserialization without registration requirements, allowing arbitrary class deserialization gadgets. The upstream fix (kryo.setRegistrationRequired(true)) was already present in the Spring Integration 5.5.12 release before TuxCare onboarded it. The fix is located in AbstractKryoCodec.java line 47, and all Kryo codec implementations (PojoCodec, MessageCodec) inherit this protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.23; >= 5.3.0, < 5.3.2; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8), NVD (>= 4.3.0, <= 4.3.22; >= 5.1.0, <= 5.1.11; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.1), cve.org (>= 4.3, < 4.3.23.RELEASE; >= 5.1, < 5.1.12.RELEASE; >= 5.2, < 5.2.8.RELEASE; >= 5.3, < 5.3.2.RELEASE), Snyk (>= 4.3.0, < 4.3.23; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.2)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-27T11:08:04.052658+00:00",
      "status_notes": "Vulnerability CVE-2026-47856 is fixed in version 5.5.12-tuxcare.3 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-47856"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-27T11:08:04.052658+00:00",
      "status_notes": "Vulnerability CVE-2026-59292 is fixed in version 5.5.12-tuxcare.3 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59292"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-27T11:08:04.052658+00:00",
      "status_notes": "Vulnerability CVE-2026-59322 is fixed in version 5.5.12-tuxcare.3 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59322"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-27T11:08:04.052658+00:00",
      "status_notes": "Vulnerability CVE-2026-59324 is fixed in version 5.5.12-tuxcare.3 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59324"
      }
    }
  ]
}